Commit Graph

9655 Commits

Author SHA1 Message Date
Adolf Belka
e42665e594 aws-cli: Update to version 1.22.64
- Update from 1.18.188 to 1.22.64
- Update of rootfile
- Ran aws in shell and got help response so it is working in principle
- Changelog is too large, with nearly 1700 lines, to include here as there appears to be
   a new release nearly every day. so there are a huge number of releases between 1.18.188
   from Dec 2nd 2020 to 1.22.64 from Feb 28 2022. It appears that only at weekends no
   releases are done. Full changelog can be viewed at
   https://github.com/aws/aws-cli/blob/develop/CHANGELOG.rst

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-10 10:41:38 +00:00
Michael Tremer
6a95e9841b core166: Ship NTFS-3G
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-10 10:41:09 +00:00
Adolf Belka
b09ef37023 ntfs-3g: Update to version 2021.8.22
- Update from 2017.3.23 to 2021.8.22
- Update of rootfile
- Added link to mkfs.ntfs in lfs to provide the binary in sbin as the new package places it
   in usr/sbin
- Ran find-dependencies and no problems flagged up.
- Changelog
	Stable Version 2021.8.22 (August 30, 2021)
	    Fixed compile error when building with libfuse < 2.8.0
	    Fixed obsolete macros in configure.ac
	    Signalled support of UTIME_OMIT to external libfuse2
	    Fixed an improper macro usage in ntfscp.c
	    Updated the repository change in the README
	    Fixed vulnerability threats caused by maliciously tampered NTFS partitions
	Stable Version 2017.3.23AR.6 (February 1, 2021)
	    Used kernel cacheing on read-only mounts or with lowntfs-3g
	    Avoided information leak when processing garbled compressed data
	    Defined option posix_nlink to compute a Posix compliant st_nlink
	    Recovered space when an index root is shortened
	    Replaced ENODATA with ENOATTR in xattrs functions for macOS
	    Added support for 'position' argument in macOS xattr functions
	    Changed default xattr access method to 'openxattr' for macOS builds
	    Allowed redefining the target location of the ntfsprogs tools
	    Fixed updating the allocated size when attribute lies in an extent
	    Enabled actions on directories in reparse plugins
	    Inserted the reparse tag in the bad reparse symlink
	    Supported use of WSL special files
	    Dropped rejecting having both EA and reparse data
	    Enabled Creating special files the same way as WSL
	    Checked the locations of MFT and MFTMirr at startup
	Stable Version 2017.3.23AR.5 (April 1, 2020)
	    Processed the request argument of ioctl() as unsigned
	    Accepted alternative recording of cluster size
	    Fixed a poorly sized string in ntfsinfo
	    Fixed ntfsfallocate on a void file
	    Decoded execlink reparse points
	    Fixed object type returned in readdir() for reparse points
	    Exported the translations of Windows paths to current ones
	Stable Version 2017.3.23AR.4 (March 1, 2019)
	    Fixed reporting an error when failed to build the mountpoint
	    Reverted accessing reparse directory through internal plugins
	    Cleaned object ids beyond the updated part
	    Fixed reacting to missing plugin
	    Returned a low level error when an ioctl fails
	    Truncated SSD trimming zones to granularity supported by the device
	Stable Version 2017.3.23AR.3 (September 1, 2018)
	    Made sure log file buffers are properly aligned
	    Made reparse directories visible through internal plugins
	    Added an option to ntfscp to copy the modification time
	    Renamed undeleted files to avoid overwriting existing ones
	    Extended the allowed cluster size to 2MB
	    Allocated full clusters for reading and rescuing in ntfsclone
	    Prevented locally defined headers from interfering with ntfs-3g ones
	    Attempted mounting read-only after failed permission to read-write
	    Fixed collecting the label argument in mkntfs
	Stable Version 2017.3.23AR.2 (March 1, 2018)
	    Made sure log file buffers are properly aligned
	    Checked log file blocks more recent than temporary ones
	    Processed redo log actions associated to undoing a CompensationlogRecord
	    Allowed setting a file object id without defining its birth ids
	    Documented read-only mount when Windows is hibernated
	    Stopped checking matches of MFTMirr against MFT at record 16
	    Filtered out reparse flags for selecting plugins
	    Delayed updating the MFT runlist when resizing in read-only mode
	    Double-checked whether record 15 is an extent of MFT
	    Checked whether the device to mount was forced read-only
	Stable Version 2017.3.23AR.1 (October 1, 2017)
	    Bypassed cluster allocation errors using --ignore-fs-check in ntfsclone
	    Upgraded ntfsrecover to support log files for Windows 10
	    Fixed the computation of highest_vcn when applying a runlist fixup
	    Fixed updating the vcn of subtree in ntfsrecover
	    Relaxed checks on security descriptors
	    Enabled directory operations in plugins
	    Decoded more reparse tags in ntfsinfo
	    Logged falling back to mounting read-only
	    Fixed compiling on MacOSX (Erik Larsson)

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-10 10:40:37 +00:00
Michael Tremer
13329f16f1 core166: Ship libdnet
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-10 10:40:24 +00:00
Adolf Belka
309726a454 libdnet: Update to version 1.14
- Update from 1.11 (2005) to 1.14 (2020)
- Update of rootfile
- find-dependencies run and no problems flagged
- Package was originally provided by Dug Song in source forge and with a github repository
  No response was received from Dug Song to requests for updates and fixes so Oliver Falk
  forked the repository and has been working on it and now the Dug Song repository is no
  longer present and the old repoistory url redirects to the new ofalk repository
  https://github.com/ofalk/libdnet
- Issues raised in this new repository are being actively responded to
- Changelog comment is
   Finally release 1.14 with latest fixes included.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-10 10:39:49 +00:00
Michael Tremer
1a32c93bcf core166: Ship harfbuzz
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-10 10:39:16 +00:00
Adolf Belka
4e52721aa2 harfbuzz: Update to version 3.4.0
- Update from 3.1.2 to 3.4.0
- Update of rootfile
- Changelog
	3.4.0
	    Perform sanity checks on shaping results is now part of “harfbuzz” library and can be enabled by setting the buffer flag HB_BUFFER_FLAG_VERIFY. (Behdad Esfahbod)
	    Arabic Mark Transient Reordering Algorithm have been updated to revision 6. (Khaled Hosny)
	    ISO 15924 code for mathematical notation, ‘Zmth’, now maps to the OpenType ‘math’ tag. (Alexis King)
	    It is now possible to get at once all math kerning values for a given glyph at a given corner. (Alexis King)
	    Fix locale_t portability issues on systems the typedef’s it to a void pointer. (Behdad Esfahbod)
	  New API:
	    +HB_BUFFER_FLAG_VERIFY
	    +HB_OT_TAG_MATH_SCRIPT
	    +HB_SCRIPT_MATH
	    +hb_ot_math_kern_entry_t
	    +hb_ot_math_get_glyph_kernings
	  Deprecated API
	    +HB_OT_MATH_SCRIPT
	3.3.2
	  Revert splitting of pair positioning values introduced in 3.3.0 as it proved problematic. (Behdad Esfahbod)
	3.3.1
	  Fix heap-use-after-free in harfbuzz-subset introduced in previous release. (Garret Rieger)
	3.3.0
	    Improved documentation. (Matthias Clasen)
	    Internal code cleanup, using C++ standard library more. (Behdad Esfahbod)
	    The low 16-bits of face index will be used by hb_face_create() to select a face inside a font collection file format, while the high 16-bits will be used by hb_font_create() to load the named instance. (Behdad Esfahbod)
	    Glyph positions and other font metrics now apply synthetic slant set by hb_font_set_synthetic_slant(), for improved positioning for synthetically slanted fonts. (Behdad Esfahbod)
	    Fixed unintentional locale dependency in hb_variation_to_string() for decimal point representation. (Matthias Clasen)
	    When applying pair positioning (kerning) the positioning value is split between the two sides of the pair for improved cursor positioning between such pairs. (Behdad Esfahbod)
	    Introduced new HB_GLYPH_FLAG_UNSAFE_TO_CONCAT, to be used in conjunction with HB_GLYPH_FLAG_UNSAFE_TO_BREAK for optimizing re-shaping during line breaking. Check the documentation for further details. (Behdad Esfahbod)
	    Improved handling of macrolanguages when mapping BCP 47 codes to OpenType tags. (David Corbett)
	    New API:
	    +HB_GLYPH_FLAG_UNSAFE_TO_CONCAT
	    +hb_segment_properties_overlay()
	    +hb_buffer_create_similar()
	    +hb_font_set_synthetic_slant()
	    +hb_font_get_synthetic_slant()
	    +hb_font_get_var_coords_design()
	3.2.0
	  harfbuzz library improvements:
	    Fixed shaping of Apple Color Emoji flags in right-to-left context. (Behdad Esfahbod)
	    Fixed positioning of CFF fonts in HB_TINY profile. (Behdad Esfahbod)
	    OpenType 1.9 language tags update. (David Corbett)
	    Add HB_NO_VERTICAL config option. (Behdad Esfahbod)
	    Add HB_CONFIG_OVERRIDE_H for easier configuration. (Behdad Esfahbod)
	  harfbuzz-subset library improvements:
	    Improved packing of cmap, loca, and Ligature tables. (Garret Rieger)
	    Significantly improved overflow-resolution strategy in the repacker. (Garret Rieger)

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-10 10:38:57 +00:00
Michael Tremer
a6faddb31d core166: Ship wireless-regdb
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-10 10:38:39 +00:00
Michael Tremer
b22cec64d9 core166: Ship SQLite
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-10 10:38:04 +00:00
Michael Tremer
6410997d2a core166: Ship OpenSSH
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-10 10:37:23 +00:00
Michael Tremer
64a2131815 Start Core Update 166
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-10 10:34:48 +00:00
Michael Tremer
d29b3c77ac Sync next with master 2022-03-10 10:29:57 +00:00
Michael Tremer
eb41bf304e samba: Fix rootfile on x86_64
The web UI menu entry, samba.cgi and the control binary were lost in
61d7aaa3ef.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-10 10:25:19 +00:00
Stefan Schantl
47b2640d37 general-functions.pl: Do not die if no red interface could be determined.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-09 15:46:19 +00:00
Stefan Schantl
74659290e9 rules.pl: Do not create HOSTILE rules if no red dev is available.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-09 15:45:59 +00:00
Stefan Schantl
870c223e0f rules.pl: Adjust code to use sets generated by libloc 0.9.11
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-09 15:43:17 +00:00
Stefan Schantl
cd3e5923fe libloc: Update to 0.9.11
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-09 15:41:49 +00:00
Michael Tremer
7f8bb55a60 core165: Ship hyperscan
This package is being built with a different configuration.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-08 10:42:00 +00:00
Michael Tremer
b69659af02 core164: Ship backup exclude file
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-07 18:53:09 +00:00
Michael Tremer
c7e0d73e7c backup: Make include/exclude files relative
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-07 18:51:23 +00:00
Michael Tremer
3f8e70f6b3 backup: Don't restore excluded files
Sometimes, we restore a backup that has been created earlier before
exclude files have been changed. To avoid overwriting those files, we
will consider the exlude list upon restore.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-07 18:51:20 +00:00
Michael Tremer
ca1fdb6954 backup: Exclude oinkmaster.conf
This file is a system configuration file and does not contain any
configruation from the user.

Since it can be overwritten in a backup and restored to an older state,
this can cause problems such as #12788.

Fixes: #12788
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-07 18:51:17 +00:00
Michael Tremer
fc717041c4 backup: Abort when the backup could not be extracted
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-07 18:51:14 +00:00
Stefan Schantl
dcacf03e80 ids-functions.pl: Do not create an empty ignored settings file.
The file will be created by the WUI, when adding the first host.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-07 18:50:34 +00:00
Stefan Schantl
da3611b276 ids-functions.pl: Do not try to chown files while extracting them.
We are almost running as an unprivileged user and therfore have not
the permissions to do this.

This will save us a lot of confusion error messages.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-07 18:49:37 +00:00
Peter Müller
6fe4eb6094 Core Update 165: Rename squid-accounting add-on to proxy-accounting
https://lists.ipfire.org/pipermail/development/2022-February/012482.html

The second version of this patch omits bogus directives for restarting a
service, which proxy-accounting is not.

Cc: Michael Tremer <michael.tremer@ipfire.org>
Cc: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-07 18:47:23 +00:00
Michael Tremer
ea04468d07 core165: Ship ids.cgi
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-07 18:46:34 +00:00
Michael Tremer
7b82d83d7e core165: Ship optionsfw.cgi
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-07 18:45:58 +00:00
Stefan Schantl
9106bfca42 ids-functions.pl: Merge same named rulefiles during extract.
In case a rulestarball contains several same-named rulefiles
they have been overwritten each time and so only contained the content
from the last extracted one.

Now the content of those files will be merged by appending the content
to the first extracted one for each time.

Fixes #12792.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-07 17:04:15 +00:00
Stefan Schantl
cad8657532 ids-functions.pl: Do not create an empty ignored settings file.
The file will be created by the WUI, when adding the first host.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2022-03-05 19:28:24 +00:00
Stefan Schantl
2b12a010d7 ids-functions.pl: Merge same named rulefiles during extract.
In case a rulestarball contains several same-named rulefiles
they have been overwritten each time and so only contained the content
from the last extracted one.

Now the content of those files will be merged by appending the content
to the first extracted one for each time.

Fixes #12792.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2022-03-05 19:28:08 +00:00
Peter Müller
ade2424f6b Revert "Core Update 165: Ship update-ids-ruleset"
update-ids-rulesets is relevant for Core Update 164, not Core Update 165.

This reverts commit 9713023546.
2022-03-05 14:35:09 +00:00
Peter Müller
4003479449 Core Update 164: Ship update-ids-rulesets
@Michael: Please cherry-pick this one into "master" as well.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-03-05 14:34:39 +00:00
Stefan Schantl
96e2e870aa firewall-lib.pl: Remove prefix when dealing with ipset sets.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2022-03-05 14:32:58 +00:00
Stefan Schantl
5841800969 rules.pl: Autodetect ipset db file to restore.
This commit allows the ipset_restore() function to auto-detect
which set file needs to be restored.

Currently it is limitated to country codes only, because we currently
does not support anything else.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2022-03-05 14:32:44 +00:00
Stefan Schantl
7b529f5417 firewall: Move dropping hostile networks to rules.pl.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-05 14:31:55 +00:00
Stefan Schantl
2801213dcc rules.pl: Allow dynamic destory of loaded but unused ipset sets.
Instead of stupidly destroying all ipsets, we now grab the already loaded sets
and compare them with the loaded sets during runtime of the script.

So we are now able to determine which sets are not longer required and
safely can destroy (unload) at a later time.

This saves us from taking care about dropping/flushing rules which are
based on ipset before we can destroy them - because only unused sets are
affected.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Inspired-by: Tim FitzGeorge <ipfr@tfitzgeorge.me.uk>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-05 14:31:51 +00:00
Peter Müller
65808f8478 update ca-certificates CA bundle
Update the CA certificates list to what Mozilla NSS ships currently.

The original file can be retrieved from:
https://hg.mozilla.org/mozilla-central/raw-file/tip/security/nss/lib/ckfw/builtins/certdata.txt

Please note that the certdata.txt file only appears to drop MD5
checksums in favour of SHA256, so there is no need in shipping
ca-certificates with the next Core Update.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-03-05 14:31:02 +00:00
Peter Müller
9713023546 Core Update 165: Ship update-ids-ruleset
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-03-05 14:30:10 +00:00
Stefan Schantl
8353e28ad2 ids-functions.pl: Do not try to chown files while extracting them.
We are almost running as an unprivileged user and therfore have not
the permissions to do this.

This will save us a lot of confusion error messages.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2022-03-05 14:28:36 +00:00
Michael Tremer
419153571b backup: Make include/exclude files relative
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-04 10:41:30 +00:00
Michael Tremer
e5ad6e2ab1 backup: Don't restore excluded files
Sometimes, we restore a backup that has been created earlier before
exclude files have been changed. To avoid overwriting those files, we
will consider the exlude list upon restore.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-04 10:37:00 +00:00
Michael Tremer
026935a137 backup: Exclude oinkmaster.conf
This file is a system configuration file and does not contain any
configruation from the user.

Since it can be overwritten in a backup and restored to an older state,
this can cause problems such as #12788.

Fixes: #12788
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-04 10:27:01 +00:00
Michael Tremer
270d572504 backup: Abort when the backup could not be extracted
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-04 10:19:14 +00:00
Michael Tremer
a735dad621 python3-cffi: Fix armv6l rootfile
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-02 13:37:28 +00:00
Peter Müller
d739da6f47 python3-cffi: Add 32 bit ARM rootfile again due to "gnueabi" != "gnu"
My fault, again. :-/

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-03-01 15:25:01 +00:00
Peter Müller
70e23c18a4 python3-yaml: Drop unnecessary armv6l rootfile
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-02-28 20:18:58 +00:00
Peter Müller
67a38b30b0 Merge branch 'master' into next 2022-02-28 20:16:38 +00:00
Arne Fitzenreiter
6e2c8f4818 suricata: drop unsupported JA3 rule provider
our current suricata version not support JA3 based rules so
this drop the providers from the list.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2022-02-26 14:19:45 +00:00
Peter Müller
f6ec32737f borgbackup: Fix rootfile on 32 bit ARM
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-02-26 12:16:39 +00:00